@freedomofpress/webcat 0.0.0-stage → 3.0.0

package/dist/lib/webcat/ui.js

@@ -0,0 +1,282 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var _db, _warnings, _showWarnings, _WebcatUI_instances, onPermissionsChanged_fn, onErrorPageNavigation_fn, _onNavigation;
+import { BrowserChromeController } from "../browser/chrome.js";
+import permissions from "../browser/permissions.js";
+import { WebcatErrorCode } from "./interfaces/errors.js";
+import { logger } from "./logger.js";
+import { getFQDN, clearBrowserCaches } from "./utils.js";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError2 = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError2("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError2("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) fns[i].call(self);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var it, done, ctx, k = flags & 7, p = false;
+  var j = 0;
+  var extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (target = target.prototype, k < 5 && (k > 3 || !p) && __getOwnPropDesc(target, name));
+  __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    it = (0, decorators[i])(target, ctx), done._ = 1;
+    __expectFn(it) && (target = it);
+  }
+  return __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var _WebcatUI_decorators, _init, _a;
+_WebcatUI_decorators = [permissions.require("webNavigation")];
+class WebcatUI extends (_a = BrowserChromeController) {
+  /**
+   * @param db The database to load enrollments from.
+   * @param store The store to use for persistence.
+   * @param config
+   */
+  constructor(db, store, config) {
+    super(config);
+    __privateAdd(this, _WebcatUI_instances);
+    __privateAdd(this, _db);
+    __privateAdd(this, _warnings);
+    __privateAdd(this, _showWarnings, false);
+    __privateAdd(this, _onNavigation, async function(details) {
+      if (details.frameId !== 0) {
+        return;
+      }
+      const title = await browser.pageAction.getTitle({ tabId: details.tabId });
+      if (title !== browser.i18n.getMessage("WEBCAT_webcatVerificationFailed")) {
+        this.showWarningIcon(details.tabId);
+      }
+    }.bind(this));
+    __privateSet(this, _db, db);
+    __privateSet(this, _warnings, store.namespace("warnings"));
+    permissions.addEventListener(
+      "permissionerror",
+      __privateMethod(this, _WebcatUI_instances, onPermissionsChanged_fn).bind(this)
+    );
+    permissions.addEventListener(
+      "permissionrestored",
+      __privateMethod(this, _WebcatUI_instances, onPermissionsChanged_fn).bind(this)
+    );
+    browser.webNavigation.onCommitted.addListener(
+      __privateMethod(this, _WebcatUI_instances, onErrorPageNavigation_fn).bind(this),
+      { url: [{ urlPrefix: this.getPageURL("error") }] }
+    );
+  }
+  /**
+   * Displays the default WEBCAT icon in the browser's URL bar. If the UI has
+   * warnings, shows the warning icon instead.
+   *
+   * @param tabId The ID of the tab to display the icon in.
+   * @param options Icon options.
+   */
+  async showIcon(tabId, options) {
+    if (__privateGet(this, _showWarnings)) {
+      await this.showWarningIcon(tabId);
+      return;
+    }
+    await super.showIcon(tabId, {
+      name: options?.name ?? "webcat",
+      title: options?.title ?? browser.i18n.getMessage("WEBCAT_webcatIsRunning"),
+      popup: options?.popup
+    });
+  }
+  /**
+   * Displays the warning icon in the browser's URL bar. Clicking on the icon
+   * opens the popup with full warning info.
+   *
+   * @param tabId The ID of the tab to display the icon in.
+   */
+  async showWarningIcon(tabId) {
+    const warnings = {};
+    for (const key of await __privateGet(this, _warnings).getKeys()) {
+      warnings[key] = await __privateGet(this, _warnings).get(key);
+    }
+    await super.showIcon(tabId, {
+      // We don't have a separate icon for warnings, at least for now
+      name: "webcat-error",
+      title: browser.i18n.getMessage("WEBCAT_webcatNotOperational"),
+      popup: {
+        name: "popup",
+        fragment: new URLSearchParams({ warnings: JSON.stringify(warnings) })
+      }
+    });
+  }
+  /**
+   * Displays the OK icon in the browser's URL bar. If the UI has warnings,
+   * shows the warning icon instead.
+   *
+   * @param tabId The ID of the tab to display the icon in.
+   * @param delegation Optional delegation information to include in the title
+   *   text.
+   */
+  async showOKIcon(tabId, delegation) {
+    if (__privateGet(this, _showWarnings)) {
+      await this.showWarningIcon(tabId);
+      return;
+    }
+    logger.addLog(
+      "info",
+      delegation ? `Setting ok icon (delegation: ${delegation})` : "Setting ok icon",
+      tabId,
+      ""
+    );
+    let title = browser.i18n.getMessage("WEBCAT_webcatVerificationSuccessful");
+    if (delegation) {
+      title += ` (${delegation})`;
+    }
+    await super.showIcon(tabId, {
+      name: "webcat-ok",
+      title
+    });
+  }
+  /**
+   * Displays the error icon in the browser's URL bar.
+   *
+   * @param tabId The ID of the tab to display the icon in.
+   */
+  async showErrorIcon(tabId) {
+    await super.showIcon(tabId, {
+      name: "webcat-error",
+      title: browser.i18n.getMessage("WEBCAT_webcatVerificationFailed")
+    });
+  }
+  /**
+   * Loads the error page in the tab(s) indicated by details.
+   *
+   * @param details Details for the request that triggered the error.
+   * @param error The error information.
+   * @param replace true to replace the current history entry, false to add a
+   *   new one.
+   */
+  async showErrorPage(details, error, replace = !details.state.isFrame) {
+    const tabIds = /* @__PURE__ */ new Set();
+    const frameLookups = [];
+    if (details.tabId < 0) {
+      const tabs = await browser.tabs.query({});
+      for (const tab of tabs) {
+        if (tab.url && tab.id && /https?:\/\//i.test(tab.url) && details.state.fqdn === getFQDN(tab.url)) {
+          tabIds.add(tab.id);
+        } else if (tab.id) {
+          frameLookups.push(
+            browser.webNavigation.getAllFrames({ tabId: tab.id }).then(
+              (frames) => frames.forEach((frame) => {
+                if (/https?:\/\//i.test(frame.url) && details.state.fqdn === getFQDN(frame.url)) {
+                  tabIds.add(frame.tabId);
+                }
+              })
+            )
+          );
+        }
+      }
+      await Promise.all(frameLookups);
+    } else {
+      tabIds.add(details.tabId);
+    }
+    const code = error.code;
+    const params = new URLSearchParams({ code, host: details.state.fqdn });
+    if ((code === WebcatErrorCode.File.MISMATCH || code === WebcatErrorCode.File.MISSING) && error?.details?.[0]) {
+      params.set("file", error.details[0]);
+    }
+    const tabUpdates = [];
+    tabIds.forEach(
+      (tabId) => tabUpdates.push(
+        this.loadPage(tabId, "error", {
+          fragment: params,
+          replace
+        })
+      )
+    );
+    await Promise.all(tabUpdates);
+    await clearBrowserCaches([details.state.fqdn]);
+  }
+  /**
+   * Sets the message for the specified warning.
+   *
+   * @param id The ID of the warning.
+   * @param args The arguments of the warning. Must be serializable as JSON.
+   */
+  async setWarning(id, ...args) {
+    await __privateGet(this, _warnings).set({ [id]: args });
+    if (__privateGet(this, _showWarnings) === false) {
+      browser.webNavigation.onCommitted.addListener(__privateGet(this, _onNavigation));
+      const tabs = await browser.tabs.query({});
+      await Promise.all(
+        tabs.map(async (tab) => {
+          const title = await browser.pageAction.getTitle({
+            tabId: tab.id
+          });
+          if (title !== browser.i18n.getMessage("WEBCAT_webcatVerificationFailed")) {
+            this.showWarningIcon(tab.id);
+          }
+        })
+      );
+    }
+    __privateSet(this, _showWarnings, true);
+  }
+  /**
+   * Clears a specific warning from the UI.
+   *
+   * @param id The ID of the warning to clear.
+   */
+  async clearWarning(id) {
+    await __privateGet(this, _warnings).remove(id);
+    const warnings = await __privateGet(this, _warnings).getKeys();
+    if (warnings.length === 0) {
+      __privateSet(this, _showWarnings, false);
+      browser.webNavigation.onCommitted.removeListener(__privateGet(this, _onNavigation));
+      const tabs = await browser.tabs.query({});
+      await Promise.all(
+        tabs.map(async (tab) => {
+          const title = await browser.pageAction.getTitle({
+            tabId: tab.id
+          });
+          if (title === browser.i18n.getMessage("WEBCAT_webcatNotOperational")) {
+            await this.hideIcon(tab.id);
+          }
+        })
+      );
+    }
+  }
+}
+_db = new WeakMap();
+_warnings = new WeakMap();
+_showWarnings = new WeakMap();
+_WebcatUI_instances = new WeakSet();
+onPermissionsChanged_fn = async function() {
+  const missing = permissions.getMissing();
+  if (missing.size > 0) {
+    await this.setWarning("permissions", Array.from(missing).sort());
+  } else {
+    await clearBrowserCaches(await __privateGet(this, _db).listAllFQDNs());
+    this.clearWarning("permissions");
+  }
+};
+onErrorPageNavigation_fn = async function(details) {
+  await this.showErrorIcon(details.tabId);
+};
+_onNavigation = new WeakMap();
+_init = __decoratorStart(_a);
+WebcatUI = __decorateElement(_init, 0, "WebcatUI", _WebcatUI_decorators, WebcatUI);
+__runInitializers(_init, 1, WebcatUI);
+export {
+  WebcatUI
+};

package/dist/lib/webcat/updater.d.ts

@@ -0,0 +1,115 @@
+import { ValidatorJson } from "@freedomofpress/cometbft/dist/types";
+import { Database } from "./interfaces/database";
+/**
+ * An event indicating the completion of an update attempt.
+ */
+export declare class UpdateEvent extends Event {
+    /**
+     * Indicates whether the update was local or networked. Set to true for
+     * updates loaded from local files and false for updates done over the
+     * network.
+     */
+    readonly local: boolean;
+    /**
+     * Indicates whether the update was successful. Set to true if the update
+     * resulted in a new block being applied. If false, the update may have
+     * failed with an error, or there may not have been anything to update.
+     */
+    readonly success: boolean;
+    constructor(success: boolean, local?: boolean);
+}
+/**
+ * Options for an {@link EnrollmentUpdater}.
+ */
+export interface EnrollmentUpdaterConfig {
+    /**
+     * The update endpoint that serves verifiable enrollments as `list.json` and
+     * `block.json`.
+     */
+    endpoint: string;
+    /**
+     * The path to bundled `list.json` and `block.json` files.
+     */
+    localDataPath: string;
+    /**
+     * The database to persist enrollments in.
+     */
+    database: Database;
+    /**
+     * The set of CometBFT validators to verify enrollments against.
+     */
+    validatorSet: ValidatorJson;
+    /** Expected CometBFT chain ID; blocks from any other chain are rejected. */
+    chainId: string;
+    /**
+     * The time in milliseconds between enrollment update checks. Determines how
+     * often the extension is activated to check whether an update is due. An
+     * update is only downloaded if, at check time, {@link updateInterval} has
+     * elapsed since the last update.
+     *
+     * @defaultValue {@link EnrollmentUpdater.DefaultCheckInterval}
+     */
+    checkInterval?: number;
+    /**
+     * The minimum time in milliseconds between updates. Update checks are run
+     * periodically at an interval determined by this value. An update is only
+     * downloaded when a {@link checkInterval | check } runs and updateInterval
+     * has elapsed since the last update.
+     *
+     * @defaultValue {@link EnrollmentUpdater.DefaultUpdateInterval}
+     */
+    updateInterval?: number;
+    /**
+     * The timeout, in milliseconds, of update download attempts.
+     *
+     * @defaultValue {@link EnrollmentUpdater.DefaultFetchTimeout}
+     */
+    fetchTimeout?: number;
+}
+export interface EnrollmentUpdater extends EventTarget {
+    /** @group Methods */
+    addEventListener: EventTarget["addEventListener"] & ((type: "updated", callback: (event: UpdateEvent) => void) => void);
+}
+/**
+ * Handles loading enrollment updates periodically from the endpoint,
+ * storing them to the database, and notifying event consumers.
+ */
+export declare class EnrollmentUpdater extends EventTarget {
+    #private;
+    /**
+     * The default value for {@link EnrollmentUpdaterConfig.checkInterval},
+     * 5 minutes.
+     */
+    static readonly DefaultCheckInterval: number;
+    /**
+     * The default value for {@link EnrollmentUpdaterConfig.updateInterval},
+     * 1 hour.
+     */
+    static readonly DefaultUpdateInterval: number;
+    /**
+     * The default value for {@link EnrollmentUpdaterConfig.fetchTimeout},
+     * 3 seconds.
+     */
+    static readonly DefaultFetchTimeout = 3000;
+    constructor(options: EnrollmentUpdaterConfig);
+    /**
+     * Loads bundled enrollments and initiates periodic updates.
+     */
+    start(): void;
+    /**
+     * Immediately does a single update. If local is true, only the enrollment
+     * files bundled with the extension are consulted without accessing the network.
+     */
+    update(local?: boolean): Promise<void>;
+    /**
+     * Retries an update if the previous attempt failed. Unlike {@link update},
+     * retryIfFailed never throws.
+     */
+    retryIfFailed(): Promise<void>;
+    /**
+     * Determines whether an update is due.
+     *
+     * @returns A Promise that resolves to true if an update is due.
+     */
+    isDue(): Promise<boolean>;
+}

package/dist/lib/webcat/updater.js

@@ -0,0 +1,296 @@
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var __using = (stack, value, async) => {
+  if (value != null) {
+    if (typeof value !== "object" && typeof value !== "function") __typeError("Object expected");
+    var dispose, inner;
+    if (async) dispose = value[__knownSymbol("asyncDispose")];
+    if (dispose === void 0) {
+      dispose = value[__knownSymbol("dispose")];
+      if (async) inner = dispose;
+    }
+    if (typeof dispose !== "function") __typeError("Object not disposable");
+    if (inner) dispose = function() {
+      try {
+        inner.call(this);
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    };
+    stack.push([async, dispose, value]);
+  } else if (async) {
+    stack.push([async]);
+  }
+  return value;
+};
+var __callDispose = (stack, error, hasError) => {
+  var E = typeof SuppressedError === "function" ? SuppressedError : function(e, s, m, _) {
+    return _ = Error(m), _.name = "SuppressedError", _.error = e, _.suppressed = s, _;
+  };
+  var fail = (e) => error = hasError ? new E(e, error, "An error was suppressed during disposal") : (hasError = true, e);
+  var next = (it) => {
+    while (it = stack.pop()) {
+      try {
+        var result = it[1] && it[1].call(it[2]);
+        if (it[0]) return Promise.resolve(result).then(next, (e) => (fail(e), next()));
+      } catch (e) {
+        fail(e);
+      }
+    }
+    if (hasError) throw error;
+  };
+  return next();
+};
+var _endpoint, _localDataPath, _db, _validatorSet, _chainId, _checkInterval, _updateInterval, _fetchTimeout, _alarm, _mutex, _lastUpdateFailed, __EnrollmentUpdater2_instances, checkAndUpdate_fn, handleUpdateAlarm_fn, fetchWithTimeout_fn, _a2;
+import { importCommit } from "@freedomofpress/cometbft/dist/commit";
+import { verifyCommit } from "@freedomofpress/cometbft/dist/lightclient";
+import { importValidators } from "@freedomofpress/cometbft/dist/validators";
+import { verifyWebcatProof } from "@freedomofpress/ics23/dist/webcat";
+import permissions from "../browser/permissions.js";
+import { Mutex } from "../browser/sync.js";
+import { Uint8ArrayToBase64, hexToUint8Array } from "./encoding.js";
+import { arraysEqual } from "./utils.js";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __knownSymbol2 = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError2 = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol2("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError2("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError2("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol2("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) fns[i].call(self);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var it, done, ctx, k = flags & 7, p = false;
+  var j = 0;
+  var extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (target = target.prototype, k < 5 && (k > 3 || !p) && __getOwnPropDesc(target, name));
+  __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    it = (0, decorators[i])(target, ctx), done._ = 1;
+    __expectFn(it) && (target = it);
+  }
+  return __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var _EnrollmentUpdater_decorators, _init, _a;
+class UpdateEvent extends Event {
+  constructor(success, local = false) {
+    super("updated");
+    this.success = success;
+    this.local = local;
+  }
+}
+_EnrollmentUpdater_decorators = [permissions.require("alarms")];
+let _EnrollmentUpdater = (_a2 = class extends (_a = EventTarget) {
+  constructor(options) {
+    super();
+    __privateAdd(this, __EnrollmentUpdater2_instances);
+    __privateAdd(this, _endpoint);
+    __privateAdd(this, _localDataPath);
+    __privateAdd(this, _db);
+    __privateAdd(this, _validatorSet);
+    __privateAdd(this, _chainId);
+    __privateAdd(this, _checkInterval);
+    __privateAdd(this, _updateInterval);
+    __privateAdd(this, _fetchTimeout);
+    __privateAdd(this, _alarm);
+    __privateAdd(this, _mutex, new Mutex());
+    __privateAdd(this, _lastUpdateFailed, false);
+    __privateSet(this, _endpoint, options.endpoint);
+    __privateSet(this, _localDataPath, options.localDataPath);
+    __privateSet(this, _db, options.database);
+    __privateSet(this, _validatorSet, options.validatorSet);
+    __privateSet(this, _chainId, options.chainId);
+    __privateSet(this, _checkInterval, options.checkInterval || _a2.DefaultCheckInterval);
+    __privateSet(this, _updateInterval, options.updateInterval || _a2.DefaultUpdateInterval);
+    __privateSet(this, _fetchTimeout, options.fetchTimeout || _a2.DefaultFetchTimeout);
+    __privateSet(this, _alarm, `webcat-scheduled-update:${options.endpoint}`);
+  }
+  /**
+   * Loads bundled enrollments and initiates periodic updates.
+   */
+  start() {
+    browser.alarms.onAlarm.addListener(__privateMethod(this, __EnrollmentUpdater2_instances, handleUpdateAlarm_fn).bind(this));
+    browser.alarms.get(__privateGet(this, _alarm)).then((alarm) => {
+      if (!alarm) {
+        browser.alarms.create(__privateGet(this, _alarm), {
+          periodInMinutes: __privateGet(this, _checkInterval) / 6e4
+        });
+      }
+      this.dispatchEvent(new Event("scheduled"));
+    });
+    console.log("[webcat] Importing bundled list");
+    this.update(true).finally(async () => {
+      console.log("[webcat] Attempting network update");
+      await __privateMethod(this, __EnrollmentUpdater2_instances, checkAndUpdate_fn).call(this);
+    }).catch((error) => {
+      console.error("[webcat] Bundled list import failed:", error);
+    });
+  }
+  /**
+   * Immediately does a single update. If local is true, only the enrollment
+   * files bundled with the extension are consulted without accessing the network.
+   */
+  async update(local = false) {
+    try {
+      console.log("[webcat] Running production list updater");
+      await __privateGet(this, _db).setLastChecked();
+      let leavesUrl;
+      let blocksUrl;
+      if (local) {
+        console.log("[webcat] Loading bundled update files");
+        leavesUrl = browser.runtime.getURL(`${__privateGet(this, _localDataPath)}/list.json`);
+        blocksUrl = browser.runtime.getURL(`${__privateGet(this, _localDataPath)}/block.json`);
+      } else {
+        console.log("[webcat] Fetching update files");
+        leavesUrl = `${__privateGet(this, _endpoint)}list.json`;
+        blocksUrl = `${__privateGet(this, _endpoint)}block.json`;
+      }
+      const leavesResponse = __privateMethod(this, __EnrollmentUpdater2_instances, fetchWithTimeout_fn).call(this, leavesUrl);
+      const blockResponse = __privateMethod(this, __EnrollmentUpdater2_instances, fetchWithTimeout_fn).call(this, blocksUrl);
+      leavesResponse.catch(() => {
+      });
+      const block = await (await blockResponse).json();
+      console.log("[webcat] Update block fetched");
+      if (void 0) ;
+      const { proto: vset, cryptoIndex } = await importValidators(
+        __privateGet(this, _validatorSet)
+      );
+      const sh = importCommit(block);
+      const out = await verifyCommit(sh, vset, cryptoIndex, __privateGet(this, _chainId));
+      if (out.ok) {
+        console.log(
+          "[webcat] Block verified, app_hash: ",
+          Uint8ArrayToBase64(out.appHash),
+          "time: ",
+          out.headerTime
+        );
+      } else {
+        throw new Error(`Block verification failed: ${out}`);
+      }
+      if (!out.headerTime) {
+        throw new Error("Block verification did not return a time");
+      }
+      const meta = await __privateGet(this, _db).getBlockMeta();
+      if (meta !== null && out.headerTime.seconds <= meta.blockTime) {
+        console.log("[webcat] Block already applied, skipping");
+        __privateSet(this, _lastUpdateFailed, false);
+        this.dispatchEvent(new UpdateEvent(false, local));
+        return;
+      }
+      const leaves = await (await leavesResponse).json();
+      if (!arraysEqual(hexToUint8Array(leaves.proof.app_hash), out.appHash)) {
+        throw new Error("app hash mismatch");
+      }
+      const verifiedLeaves = await verifyWebcatProof(leaves);
+      if (verifiedLeaves === false) {
+        throw new Error("proof did not verify against app hash");
+      }
+      await __privateGet(this, _db).updateList(verifiedLeaves, {
+        blockTime: Number(out.headerTime.seconds),
+        rootHash: leaves.proof.canonical_root_hash
+      });
+      if (!local) {
+        await __privateGet(this, _db).setLastUpdated();
+      }
+      console.log(`[webcat] List updated successfully`);
+      this.dispatchEvent(new UpdateEvent(true, local));
+      __privateSet(this, _lastUpdateFailed, false);
+    } catch (error) {
+      console.error("[webcat] Update failed:", error);
+      __privateSet(this, _lastUpdateFailed, true);
+      this.dispatchEvent(new UpdateEvent(false, local));
+      throw error;
+    }
+  }
+  /**
+   * Retries an update if the previous attempt failed. Unlike {@link update},
+   * retryIfFailed never throws.
+   */
+  async retryIfFailed() {
+    if (__privateGet(this, _lastUpdateFailed)) {
+      console.log("[webcat] Retrying failed update on main_frame navigation");
+      try {
+        await __privateMethod(this, __EnrollmentUpdater2_instances, checkAndUpdate_fn).call(this);
+      } catch (error) {
+        console.error("[webcat] Retry update failed:", error);
+      }
+    }
+  }
+  /**
+   * Determines whether an update is due.
+   *
+   * @returns A Promise that resolves to true if an update is due.
+   */
+  async isDue() {
+    const lastUpdated = await __privateGet(this, _db).getLastUpdated();
+    return lastUpdated === null || Date.now() - lastUpdated >= __privateGet(this, _updateInterval);
+  }
+}, _endpoint = new WeakMap(), _localDataPath = new WeakMap(), _db = new WeakMap(), _validatorSet = new WeakMap(), _chainId = new WeakMap(), _checkInterval = new WeakMap(), _updateInterval = new WeakMap(), _fetchTimeout = new WeakMap(), _alarm = new WeakMap(), _mutex = new WeakMap(), _lastUpdateFailed = new WeakMap(), __EnrollmentUpdater2_instances = new WeakSet(), checkAndUpdate_fn = async function() {
+  var _stack = [];
+  try {
+    const _lock = __using(_stack, await __privateGet(this, _mutex).acquire());
+    if (await this.isDue() || void 0) {
+      console.log("[webcat] Running overdue scheduled update");
+      try {
+        await this.update();
+      } catch (error) {
+        console.error("[webcat] Scheduled update failed:", error);
+      }
+    }
+  } catch (_) {
+    var _error = _, _hasError = true;
+  } finally {
+    __callDispose(_stack, _error, _hasError);
+  }
+}, handleUpdateAlarm_fn = async function(alarm) {
+  if (alarm.name !== __privateGet(this, _alarm)) {
+    return;
+  }
+  try {
+    await __privateMethod(this, __EnrollmentUpdater2_instances, checkAndUpdate_fn).call(this);
+  } catch (error) {
+    console.error("[webcat] Error in update alarm handler:", error);
+  }
+}, fetchWithTimeout_fn = async function(url, timeoutMs = __privateGet(this, _fetchTimeout)) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, {
+      cache: "no-store",
+      signal: controller.signal
+    });
+    clearTimeout(timeoutId);
+    return response;
+  } catch (error) {
+    clearTimeout(timeoutId);
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error(`Fetch timeout after ${timeoutMs}ms: ${url}`);
+    }
+    throw error;
+  }
+}, _a2.DefaultCheckInterval = 5 * 60 * 1e3, _a2.DefaultUpdateInterval = 60 * 60 * 1e3, _a2.DefaultFetchTimeout = 3e3, _a2);
+_init = __decoratorStart(_a);
+_EnrollmentUpdater = __decorateElement(_init, 0, "EnrollmentUpdater", _EnrollmentUpdater_decorators, _EnrollmentUpdater);
+__runInitializers(_init, 1, _EnrollmentUpdater);
+let EnrollmentUpdater = _EnrollmentUpdater;
+export {
+  EnrollmentUpdater,
+  UpdateEvent
+};